Monitors the status of critical security features (e.g., COMSEC) to detect if they are disabled during safe-mode operations. The security feature would need to be determined by engineer, but COMSEC is an example. An example of how to build pattern for COMSEC, [x-opencti-security-feature:feature = 'encryption' AND x-opencti-security-feature:status = 'disabled' AND x-opencti-spacecraft-status:mode = 'safe-mode']
| ID | Name | Description | |
| EX-0011 | Exploit Reduced Protections During Safe-Mode | Threat actors who have access to a spacecraft in safe mode may issue malicious commands that would not normally be accepted during nominal operations. Safe-mode is when all non-essential systems are shut down and only essential functions within the spacecraft are active. Because safe mode prioritizes essential functions and often disables non-critical protections or filters, adversaries can exploit this state to trigger unauthorized reconfiguration, software modification, or system manipulation during recovery or degraded operation. | |